CVE-2026-0406

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0406", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "state": "PUBLISHED", "assignerShortName": "NETGEAR", "dateReserved": "2025-12-03T04:16:12.706Z", "datePublished": "2026-01-13T16:00:59.458Z", "dateUpdated": "2026-02-26T15:04:44.409Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "XR1000v2", "vendor": "NETGEAR", "versions": [{"lessThanOrEqual": "1.1.0.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr1000v2:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.1.0.22", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "o4ncL1"}], "datePublic": "2026-01-13T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An insufficient input validation vulnerability in the NETGEAR XR1000v2 \nallows attackers connected to the router's LAN&nbsp;to execute OS command \ninjections.&nbsp;</p>"}], "value": "An insufficient input validation vulnerability in the NETGEAR XR1000v2 \nallows attackers connected to the router's LAN\u00a0to execute OS command \ninjections."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 6.1, "baseSeverity": "MEDIUM", "exploitMaturity": "UNREPORTED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-01-13T16:21:33.600Z"}, "references": [{"tags": ["product", "patch"], "url": "https://www.netgear.com/support/product/xr1000v2"}, {"tags": ["vendor-advisory"], "url": "https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.</p><p>Fixed in:</p><div>XR1000v2 <a href=\"https://www.netgear.com/support/product/xr1000v2\">Firmware v<strong>1.1.2.34</strong>&nbsp;or later</a></div>"}], "value": "Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.\n\nFixed in:\n\nXR1000v2 Firmware v1.1.2.34\u00a0or later https://www.netgear.com/support/product/xr1000v2"}], "source": {"discovery": "EXTERNAL"}, "title": "Insufficient input validation in NETGEAR Nighthawk router XR1000v2", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0406", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T04:57:21.534059Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:44.409Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0406", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-13T18:49:08.387722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T18:49:12.661Z"}}], "cna": {"title": "Insufficient input validation in NETGEAR Nighthawk router XR1000v2", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "o4ncL1"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 6.1, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:N/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "UNREPORTED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NETGEAR", "product": "XR1000v2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.1.0.22"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.\n\nFixed in:\n\nXR1000v2 Firmware v1.1.2.34\u00a0or later https://www.netgear.com/support/product/xr1000v2", "supportingMedia": [{"type": "text/html", "value": "<p>Devices with automatic updates enabled may already have this\npatch applied. If not, please check the firmware version and update it to the\nlatest.</p><p>Fixed in:</p><div>XR1000v2 <a href=\"https://www.netgear.com/support/product/xr1000v2\">Firmware v<strong>1.1.2.34</strong>&nbsp;or later</a></div>", "base64": false}]}], "datePublic": "2026-01-13T16:00:00.000Z", "references": [{"url": "https://www.netgear.com/support/product/xr1000v2", "tags": ["product", "patch"]}, {"url": "https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An insufficient input validation vulnerability in the NETGEAR XR1000v2 \nallows attackers connected to the router's LAN\u00a0to execute OS command \ninjections.", "supportingMedia": [{"type": "text/html", "value": "<p>An insufficient input validation vulnerability in the NETGEAR XR1000v2 \nallows attackers connected to the router's LAN&nbsp;to execute OS command \ninjections.&nbsp;</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr1000v2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.1.0.22", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "shortName": "NETGEAR", "dateUpdated": "2026-01-13T16:21:33.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0406", "state": "PUBLISHED", "dateUpdated": "2026-01-13T18:49:23.178Z", "dateReserved": "2025-12-03T04:16:12.706Z", "assignerOrgId": "a2826606-91e7-4eb6-899e-8484bd4575d5", "datePublished": "2026-01-13T16:00:59.458Z", "assignerShortName": "NETGEAR"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "XR1000v2", "vendor": "NETGEAR", "versions": [{"lessThanOrEqual": "1.1.0.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netgear:xr1000v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C8DFFA6-7390-48F5-B3DD-6547B359F107", "versionEndExcluding": "1.1.2.34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netgear:xr1000v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "697B2136-87A6-4E8F-8B5E-373B02E9D6D7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An insufficient input validation vulnerability in the NETGEAR XR1000v2 \nallows attackers connected to the router's LAN\u00a0to execute OS command \ninjections."}, {"lang": "es", "value": "Una vulnerabilidad de validaci\u00f3n de entrada insuficiente en el NETGEAR XR1000v2 permite a atacantes conectados a la LAN del router ejecutar inyecciones de comandos del sistema operativo."}], "id": "CVE-2026-0406", "lastModified": "2026-06-17T10:10:46.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0406", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T04:57:21.534059Z", "version": "2.0.3"}}]}, "published": "2026-01-13T16:16:10.690", "references": [{"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Vendor Advisory"], "url": "https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory"}, {"source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "tags": ["Patch", "Product"], "url": "https://www.netgear.com/support/product/xr1000v2"}], "sourceIdentifier": "a2826606-91e7-4eb6-899e-8484bd4575d5", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "a2826606-91e7-4eb6-899e-8484bd4575d5", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:45:23.264948+00:00", "value": {"mitigation_remediation": ["Update the router firmware to version 1.1.2.34 or later via the Netgear support page or enable automatic firmware updates to receive this patch automatically.", "If a firmware upgrade cannot be performed, immediately block or restrict access to the router\u2019s LAN interfaces that process user input, effectively disabling the vulnerable endpoint for connected devices.", "Apply network segmentation or use VLANs to isolate unmanaged or potentially compromised LAN devices from the router\u2019s administration network, limiting the attack surface until a firmware update is applied."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution via OS Command Injection"}, "threat_synthesis": {"affected_systems": "Affects the NETGEAR Nighthawk XR1000v2 router. All firmware versions earlier than 1.1.2.34 are vulnerable. The issue is specific to the XR1000v2 model; devices with firmware 1.1.2.34 or newer are considered patched.", "description_and_impact": "The vulnerability stems from an insufficient input validation flaw that allows an attacker connected to the router\u2019s LAN to inject and execute arbitrary operating\u2011system commands. This flaw can lead to full compromise of the device, enabling an attacker to access sensitive network resources, modify configuration, or launch further attacks against other devices on the local network.", "risk_and_exploitability": "The severity scored as CVSS 6.1 indicates a moderate level of risk, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local network; an attacker must establish a connection to the router\u2019s LAN interface to exploit the flaw. No additional prerequisites beyond LAN access are specified in the advisory."}}}}, "created": "2026-04-18T06:45:23.970687+00:00", "updated": "2026-04-18T06:45:23.970697+00:00", "vendors": []}